AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.
Researchers at Point Wild Threat Intelligence analyzed a campaign starting from a lure batch file ('Right-click to open Invoice Details.bat') that launches hidden PowerShell to reconstruct a Base64/XOR-obfuscated payload. The stage drops a renamed signed AutoIt interpreter and loader script into %LOCALAPPDATA%\Temp and achieves persistence via a batch file in the user's Startup folder (T1547.001). The loader decrypts the payload in memory with single-byte XOR key 0x36 and injects it into SysWOW64\charmap.exe using OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, with PE-sieve confirming an in-memory implanted PE and patched AMSI modules. The final AsyncRAT payload performs screen capture and data theft, with observed C2 at 158[.]51[.]122[.]136:4944 over raw TCP.
- Five-stage chain: batch lure, hidden PowerShell, AutoIt, in-memory decrypt, process injection
- Persistence via Startup-folder batch relaunching renamed signed AutoIt interpreter
- Injects into Microsoft-signed charmap.exe via CreateRemoteThread sequence
- AMSI patched in-process; final AsyncRAT payload captures screenshots
- C2 observed at 158.51.122.136:4944 using raw TCP
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 158.51.122.136 | and-control channel. Researchers observed a C2 indicator at 158[.]51[.]122[.]136:4944 , using raw TCP rather than web traffic. AsyncRA |
| sha256 | 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda | 122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f6b24de07b4e2396843a671adda Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a | d5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b30ab985bc8e375c7a 3200000_02C37000.exe 15700817e517fefcabc0291e350daf3e10d52f |
| sha256 | 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c | 1fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c740e7cf217bfb89a0c 3200000.exe 22678bf501fee4baeef297bd2f122ea3cbcb99c8a525b0b |
| sha256 | ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 | Cs Filename SHA-256 Right-click to open Invoice Details.bat ae4144ff75a9b6371fd4d0ce0cce0e1d7be82f3c28eeea62ed5b9b0bea3450a6 kojuyn.ini 4affb923504ddf5fdd5f4a1185bf5259110bcf96cc3f0c74 |
From the original article
3 min read at gbhackers.com
A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a . NET remote-access trojan inside Microsoft’s legitimate charmap. exe process.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.